UPVALE / GUIDES
Container registries
Add private image credentials, verify access from a cluster, and update credentials used by deployments.
On this page
A registry stores the container images that your applications and jobs run. Public images can use public / anonymous in the workload's image settings. Add credentials when the image is private or your registry requires authentication. The Registries screen requires Manage infrastructure.
Upvale deploys images that already exist in a registry. Build and push your image from your development machine or CI workflow before deploying it.
Add a registry
- Open Registries → New registry.
- Enter a Name for the saved connection.
- Enter the registry URL, such as
https://ghcr.io. Leave it empty for Docker Hub. - Enter the Username and Password / token supplied by the registry.
- Leave HTTP access disabled for a normal HTTPS registry.
- Select Add registry.
- Open the application's or job's image settings and select it from Registry.
For an image ghcr.io/my-team/api:1.2.3, the registry host is ghcr.io, repository is my-team/api, and tag is 1.2.3. Use the image preview in the form to check the final reference.
Verify access before deploying
Select Test on the registry, then:
| Field | Value |
|---|---|
| Cluster | The cluster that will use the image. This checks access through an available cluster node. |
| Repository | Repository path without the registry host or tag, such as my-team/api. |
| Tag | Existing image tag, such as 1.2.3. |
Select Run test. A successful test displays the verified image and digest without deploying a workload. A failure can mean an incorrect repository/tag, insufficient token permissions, or a network/TLS problem on the selected cluster.
Successful registry authentication alone does not guarantee access to every private repository. Test the actual image you intend to deploy.
Update credentials
Select Edit to change the name, URL, username, password/token, or HTTP setting. Leave New password / token blank to keep the stored password. New deployment work resolves the current saved credentials; editing the registry does not restart running containers.
Use a credential with permission to pull the required repositories. Your CI system needs its own permission to push images; saving a registry here does not build or upload them.
HTTP registries
Allow an HTTP registry configured as insecure on the Docker hosts is for a registry without HTTPS. Docker on the target hosts must already be configured to trust that insecure registry. The checkbox does not configure Docker for you.
HTTP can expose registry credentials and image traffic to anyone who can inspect the connection. Use HTTPS for normal deployments.
Remove a registry
Change workloads to another registry or to public access, save and deploy the changes, and wait for pending operations to finish. Upvale prevents removal while desired, deployed, or pending workload configuration depends on its credentials.
For automated image updates, see Application deployment automation. Compose can assign a saved registry per service through service settings.